Contact-Tracing Investigations

Gov. Newsom said that the ability to conduct contact tracing is important for businesses when they decide to reopen. They should understand the contact-tracing process, and why it's required.

Contact tracing is a vital investigatory tool in an employer's efforts to reduce the spread of the virus in the workplace. If contact tracing is done promptly and well, it can help determine who had close contact with an employee exposed to or infected with COVID-19, so that they can quarantine. A proper contact-tracing investigation also can help an employer determine the likelihood that an employee who is positive for COVID-19 contracted the illness in the workplace, or elsewhere. That's important for Cal/OSHA's recording requirements and for handling workers' compensation cases.

WHAT IS CONTACT TRACING?

Contact tracing is an investigation to identify employees, vendors, suppliers or clients with whom an employee might have had close contact at work. Contract tracing can be used in conjunction with a required Cal/OSHA investigation to help determine where an employee with COVID-19 contracted the illness. The key to effective contract tracing is to do it quickly to reduce the risk that other employees will be exposed to the virus, and to comply with Cal/OSHA requirements to provide a safe workplace for employees.

Contact tracing has many potential benefits. They can include:

• educating infected people about how to avoid spreading the virus;
• helping exposed contacts separate themselves from others to stop the spread of the virus;
• linking infected and exposed people with community resources during quarantine or self-isolation; and
• helping employers determine if the exposure occurred at work.

Contact tracing, however, has limitations.

• It does not stop all systematic spread because investigation starts only after symptoms appear.
• It must be done quickly to be effective.
• It has the potential to create privacy and confidentiality issues if not handled correctly.

Despite limitations, contact tracing is a valuable and legally required tool to limit the spread of COVID-19. Employers should develop contact-tracing policies as part of their return-to-work procedures, informing employees of the need to investigate if an employee contracts the virus. The information should be clear to employees that such investigations are not adversarial or judgmental. They are not intended to intrude into their private lives outside of work. Employees should understand that the purpose of contact tracing is to collect information to keep all workers safe.

All data collected during the process must be kept confidential and used only to track COVID-19 cases and monitor risk in the workplace. Information collected during the investigation should never be placed in an employee’s personnel file.

Contact tracing and notification underscore the importance of social distancing at work. Employers should encourage social distancing by:

• incorporating it into return-to-work policies and practices;
• modifying workspaces (for example, by creating workflows that limit interaction);
• staggering schedules; and
• encouraging telework.

The less close contact and movement employees have within the workplace, the lower the potential exposure, and the less likely the employer will need to trace contacts. All efforts to maintain social distance will make contact-tracing investigations more efficient and useful in determining if confirmed cases of COVID-19 are work related.

CDC GUIDANCE ON CONTACT TRACING

The Centers for Disease Control and Prevention (CDC) has issued guidance on contact tracing, which traditionally has been the job of federal, state and local health departments. The guidelines are expansive and detailed, and some might not apply to most employers. Still, all employers should review the site in conjunction with formulating their contact-tracing policies.

As more is learned about the virus and how it spreads, the CDC updates its guidance, including the definition of close contact and its recommendations regarding contact tracing.

The CDC recommends these practices specific to COVID-19:

• Contact tracing should be conducted for close contacts of people who have tested positive for coronavirus, or for probable COVID-19 patients. The CDC recently broadened the definition of "close contact," expanding the the universe of people who might be considered such contacts for purposes of tracing them. The new definition is "[s]omeone who was within 6 feet of an infected person for a cumulative total of 15 minutes or more over a 24-hour period starting with 2 days before illness onset (for asymptomatic patients, 2 days prior to test specimen collection) until the patient is isolated." Previously, "close contact" was someone who had been within 6 feet of an infected person for at least 15 minutes.
• Remote communications are preferred for investigating cases and contact tracing; in-person communication may be considered only after remote options have been exhausted.
• All close contacts of confirmed or probable COVID-19 patients should be tested.
• Contacts who test positive (symptomatic or asymptomatic) should be managed as a confirmed COVID-19 case.
• Asymptomatic contacts who test negative should self-quarantine for 14 days from their last exposure (that is, a close encounter with a confirmed or probable COVID-19 case).
• If testing is not available, symptomatic close contacts should self-isolate and be managed as a probable COVID-19 case; asymptomatic close contacts should self-quarantine and be monitored for 14 days after their last exposure, and referred to clinical care if they develop symptoms.

Effect of the New Definition of "Close Contact"

The broader definition of "close contact" considers cumulative rather than consecutive contact. That means that a person exposed three times in a 24-hour hour period –– for five minutes during each encounter –– would meet the new definition. So the sphere of people for contact-tracing purposes is greatly expanded. When determining whether an employee has been exposed to an infected employee for 15 minutes or more, employers must consider shorter interactions between workers that might occur throughout the day or the days prior to infection. Determining what is a close contact must be done regardless of whether the individual was wearing a face mask or other PPE. The CDC does offer some flexibility within the definition by including factors influencing a close-contact analysis:

• proximity of the infected worker to the close contact (closer distance = increased exposure);
• duration of the exposure (longer exposure = increased risk);
• if the infected worker has symptoms;
• if the infected worker likely generated respiratory aerosols (for example, was coughing, talking loudly, etc.);
• other factors (inside or outside, ventilation, crowding, etc).

The broader definition establishes a much lower threshold to require quarantine that could result in staffing issues. The CDC recommends sending employees home to self-monitor for 14 days if they had close contact with the infected employee. The only exception is when the business is considered essential or critical infrastructure. In that case, the close contact of the infected worker may continue to work while self-monitoring and wearing a face mask.

The revised definition is a reminder to employers to monitor social distancing and the use of PPE for all employees at the work site.

CONTACT-TRACING METHODS

Contact tracing can be done using traditional investigatory methods or through the use of newly developed apps for mobile devices. Using technology to trace contacts can be faster, more accurate and more effective than traditional face-to-face contact-tracing investigations.

Investigatory Method

Once an employer learns that an employee has tested positive for COVID-19 or has a family member who has tested positive, it should initiate contact tracing immediately. The precise approach to collect information will vary by employer and industry, but here's a basic process:

1. Designate a specfic team or an individual to perform the contact tracing.
2. Educate the team (or individual) about the importance of contact tracing, and train members how to interview employees and notify affected contacts. The team/person should be identified and trained before employees return to work.
3. Identify and interview employees with confirmed or potential COVID-19 illness with dispatch.
4. Notify employees who may have been exposed.
5. Keep investigative information confidential in separate files and never in personnel files.

Gather as much information as possible about the symptomatic employee’s work location.

• Do employees share equipment, tools or supplies?
• Who sits or works near the affected employee’s work location?
• Were the proximate employees working in the 48 hours before the affected employee first showed symptoms?

Interview symptomatic employees as soon as possible after they are identified. Investigators should ask for the names of all employees, visitors, vendors, clients or others with whom they had close contact in the workplace starting from 48 hours of the appearance of symptoms.

Employers should question employees about possible outside exposure immediately on learning of a confirmed or suspected case to help determine the likelihood of work-related exposure. Prompt investigation also will help employers to notify co-workers and others of potential exposure. Investigators should ask the affected employee how he or she believes the illness was contracted without assuming it was at the workplace.

In addition, investigators should get the names of family members with whom the employee had contact and to identify all locations outside of work the employee visited in the 48 hours before symptoms appeared. The possibilities are many –– the grocery store, church, restaurants, doctors’ offices, school, etc. Investigators should learn whom the employee spoke to at any location, and if he or she knows of any positive test results or potential exposure any of these contacts might have.

Employees should be asked specifically about close contact with any individual in the 48 hours before symptoms appeared or, if asymptomatic, 48 hours before a positive test. Close contact is defined by the CDC as people within 6 feet for at least 15 minutes.

Employees identified in No. 2 above should be informed of contact with a person in the workplace who is suspected or confirmed to have COVID-19. To maintain confidentiality, they should not be told who is the infected employee. Contacts should be given guidelines for self-quarantine, told to contact their health-care provider if they experienced COVID-19 symptoms, and given the chance to ask questions about quarantine and benefits. Potentially exposed employees asked to quarantine might be eligible for expanded sick leave benefits under the Families First Coronavirus Response Act (FFCRA).

According to the CDC, employers should send home any employees who have had a risk of exposure. They should be advised to maintain social distance, and self-monitor for 14 days from the exposure. If a business is considered essential, however, the CDC says that exposed employees may continue to work. We recommend, however, that exposed employees, whenever possible, be sent home and allowed to quarantine for the 14-day period to reduce chances of the workplace becoming a coronavirus hotspot.

Contact-Tracing Apps

The technology for contact-tracing tools is evolving rapidly. Typically, digital contact tracing alerts the user if he or she has been in contact with someone who has reported having a positive coronavirus test or COVID-19 diagnosis. Notification occurs under defined parameters –– for example, length of time with or proximity to the contact. Some apps are tied to smartphones, and others involve wearable smart devices. Similar technology also can be used to encourage social distancing through proximity tracking and beaconing between devices.

Broadly, apps can estimate the distance between two individuals who come in contact, and can estimate the time of contact. For example, if the users are fewer than 6 feet apart for, say, 15 minutes, the app logs the encounter. When the app user tests positive for coronavirus infections, and identifies himself or herself, any other user that had an encounter can be notified of the risk for infection.

The details vary of how these apps work. For example:

• what qualifies as an “encounter” –– that is, what is considered an epidemiologically relevant distance within an epidemiologically relevant time period;
• details of how an infection risk is notified;
• additional information that might be logged;
• who hosts the information collected about the user; and
• the amount of information stored by the app and for how long.

Of course, the effectiveness of the apps depends on all employees consistently using them. One downside of the app is that it doesn't provide the employer with sufficient information to determine whether the worker who tests positive for COVID-19 contracted the virus at work or some other place. Employers still must conduct an investigation to determine the likelihood of workplace exposure.

There are many unanswered questions about how contact-tracing apps work and how effective they will be. Employers should evaluate their app options for functionality before implementing one in the workplace. Among other concerns, they should study:

• what data are being collected;
• how the data are being stored (on an individual’s device or an external server);
• how long the data will be kept/stored;
• whether the app’s developer has continued access to the information; and
• what data security measures are in place (such as encryption and anonymization).

Employers also should determine how contact-tracing tools will be tailored for their business. Will the tool be voluntary or mandatory? If mandatory, will employees be discharged if they refuse to use the tool or try to disable it? Will the tool track contacts only during work hours or outside work time as well? Who in the organization will have access to information collected through the tool?

With the rapid speed of app development, guidance from federal and state jurisdictions probably will be issued. Now, however, legal guidance is limited.

LEGAL CONSIDERATIONS FOR CONTACT TRACING AND THE USE OF CONTACT-TRACING APPS

Privacy, Data and Cyber Security

Although there is no U.S. privacy law, California has several laws that protect an employee’s privacy. In general, California employees have the right to/expectation of no unreasonable, substantial or serious interference with their privacy unless these rights are outweighed by a legitimate business interest (in this case, protecting the health and safety of the employer’s workforce). The business interest must be addressed by using the least intrusive means, such as collecting only the minimal information necessary to meet a specific goal, and anonymizing all information to the extent possible.

On Jan. 1, 2020, the California Consumer Privacy Act (CCPA) went into effect. The CCPA grants California employees and consumers robust data privacy rights and control over their personal information, including the right to know and the right to delete personal information collected. The CCPA applies to any business, including any for-profit entity that collects consumer’s personal data, and satisfies at least one of these:

• has annual gross revenues in excess of $25 million;
• buys, receives or sells the personal information of 50,000 or more consumers or households; and/or
• earns more than half its annual revenue from selling consumer’s personal information.

Employees are included in the definition of “consumer,” so they are protected under this law. The term "employee" may include applicants, current/former employees, independent contractors and owners/directors/officers.

The CCPA expands employee rights, as it requires privacy notices and disclosures about the data collected by employers and the purpose for collection; allows for damages if the employee’s personal information is breached; and expands the right to request access to or deletion of personal information. Given the broad coverage of CCPA to for-profit businesses of a certain size, any covered employer who elects to use a contact-tracing app probably would be required to adhere to the CCPA notification requirement. So affected employers should prepare CCPA-compliant notices detailing the app to be used for contact tracing, the data to be collected, the purpose of data collection, where the data will be stored and who will have access to it. In addition, employees should be notified of their right to request access to the data collected and their right to have the information deleted after use. We also recommend that employers include an authorization that employees agree to use the app.

The Confidentiality of Medical Information Act (CMIA) applies to collected medical information and requires specific notices at collection and consent to share the information. The CMIA is intended to provide even greater privacy protection for medical information than does HIPAA. The act also requires employers who received medical information to safeguard it, and prohibits them from disclosing medical information without employee authorization. Given the rise and transparency required under state consumer protection laws, employers should have a COVID-19 policy that discloses all types of data collected in the contact-tracing app, and explain the purpose of such collection. Also, businesses should request employees' consent to the use of contact-tracing apps or GPS tracking.

Assuming adherence to these legal standards, an employer still would have to overcome cultural, workplace, demographic and socioeconomic differences that might limit mobile-enabled, technology-based contact tracing. Critically, effectiveness probably requires widespread adoption at a regional level. Also, many employees may not carry their phones with them at all times as a matter of personal habit or because of employment restrictions. So if the contact-tracing app is tied to a personal cellphone, it might be difficult to get accurate information, especially if it's collected while an employee is off work.

Contact tracing also raises various legal issues and concerns under the Americans with Disabilities Act, regarding privacy and confidentiality considerations.

Employers have a duty under OSHA to maintain safe working environment for their employees and to furnish a “place of employment, ... free from recognized hazards that are causing or likely to cause death or serious physical harm.” This can be a minefield for employers, but it works both ways. Considering the relatively easy transmission of the virus, according to the CDC, the employer’s obligation to investigate whether any COVID-19 infections among its employees are work related, and its responsibility to provide a safe workplace, employers have ample support for implementing a contact-tracing program that mandates employee participation.

Equal Employment Opportunity Commission and Americans with Disabilities Act

Neither the EEOC nor California’s Department of Fair Employment and Housing (DFEH) has issued guidance on contact tracing or contact-tracing apps. The EEOC, however, has issued guidelines on other employer responses to the pandemic, allowing greater than normal flexibility. The DFEH has concurred.

Specifically, employers may take employees' temperatures, may screen employees daily for symptoms, exclude employees from the workplace if they exhibit symptoms of COVID-19 and restrict access to the workplace by employees who are deemed to be a “direct threat” to the health or safety of others as a result of their COVID-19 exposure. Of course, any screening or assessment required by employers must be business related, serve business needs and no more intrusive than necessary. This is discussed in-depth in Disability and Reasonable Accommodations under the American with Disabilities Act & the Fair Employment and Housing Act.

Given the flexibility the EEOC has provided employers to deal with the coronavirus, it's probable that the ADA would allow for the use of a contact-tracing app for purposes of identifying employees who have had close contact with someone who has a positive or probable case of COVID-19. To avoid the appearance of discriminating against disabled employees, or others within an EEOC-protected category such as age, employers who use contact-tracing apps must be sure to require all employees to use them, not just some. The business reason for the collection of data –– for example, to ensure the health and safety of the workforce –– probably outweighs employee privacy concerns, as long as privacy and confidentiality guidelines are followed.

We recommend that employers considering the use of contact-tracing apps contact us to ensure that proper notice, disclosure and consent forms are provided to employees.

SEE ALSO

FAQs –– CONTACT-TRACING INVESTIGATIONS